OpenSearchCon Europe 2026

OpenSearch's ML Commons plugin enables deploying embedding models directly on your cluster—yet many developers still rely on external services. This session demonstrates building a complete RAG system using OpenSearch as both vector store and ML inference engine.

We'll cover deploying sentence-transformer models via ML Commons, processing PDFs, generating embeddings within OpenSearch, configuring knn_vector indices, and implementing semantic search. The highlight: voice search using local Whisper (STT) model creating a fully self-contained system.

What I hope to achieve: Share practical patterns for leveraging OpenSearch's ML capabilities and gather community feedback.

What attendees gain: Step-by-step knowledge to deploy ML models on OpenSearch, build RAG pipelines, and integrate local voice processing—reproducible techniques they can apply immediately.

How this helps the ecosystem: Showcases OpenSearch's native ML features, reducing dependency on external services. Demonstrates OpenSearch as a complete AI platform, not just a search engine.

Target audience: Developers building RAG applications, OpenSearch operators exploring ML capabilities.

This talk shares a hands-on journey of building and operating a large-scale OpenSearch platform in a strictly on-premises, VM-based environment. What started as an urgent Splunk replacement evolved into a Managed Detection and Response (MDR) logging platform for high ingestion rates (~40GB to 1.2TB/day per customer). 

The session focuses on real operational challenges and experiences: sizing and sharding decisions, gaps in official documentation, and the realities of owning OpenSearch end-to-end. Initially using Terraform to deploy and manual bootstrapping.

The talk includes a migration failure story from our biggest cluster, caused by accidental double ingestion, bad sizing and snapshot-induced OOMs.

At the end we have automated deployments, bootstrapping, ISM, snapshots, tiering, SSO-based access control, searchable-snapshots(on-prem S3) and automation. Due to limitations in ISM we built a custom lifecycle automation script via an operator-like pipeline and an opensearchcli binary.

Attendees gain a realistic view of running OpenSearch at scale on-prem, including lessons learned the hard way.

As OpenSearch clusters grow beyond 10–20 nodes, centralized monitoring becomes a bottleneck: single points of failure, API overload, and higher latency. Traditional approaches don’t scale.

This session presents a production-ready distributed monitoring architecture using Apache NiFi and MiNiFi. MiNiFi agents on each node collect local metrics via a custom NodeStatsProcessor (CPU, heap, JVM, I/O, thread pools), while central NiFi collectors aggregate and deduplicate cluster-wide metrics using a custom ClusterStatsProcessor and forward them to OpenSearch.

Results include linear scalability, sub-millisecond node metrics, HA, and minimal overhead. Key insights: separating local vs cluster-wide collection, deployment patterns (bare metal, VMs, containers), HA strategies with multiple NiFi collectors, and lessons from production clusters of 10–50+ nodes processing millions of metrics daily with 99.9% reliability.

Ideal for OpenSearch operators managing 10+ nodes, platform engineers building observability pipelines, and anyone hitting centralized monitoring limits. Walk away with a distributed architecture you can implement immediately.

Running OpenSearch in Kubernetes sounds simple — until you try to do it at scale, with high availability, zero downtime, and evolving workloads. In this talk, we draw on years of production experience operating OpenSearch clusters for SAP Cloud Logging service. We aim to share the key lessons learned and design patterns from building our Kubernetes operator.

We’ll dive into how we approached seamless upgrades, built tailored monitoring, and improved performance when interacting with OpenSearch APIs. Even if we adapt solutions to fit internal needs, the lessons learned are valuable for the broader OpenSearch and Kubernetes community.

In the second half, we turn our focus to the open-source OpenSearch Kubernetes Operator. We’ll explore its current state, the challenges the community is addressing and efforts to improve its reliability. We’ll also discuss how this open-source offering enables organizations to seamlessly scale and manage OpenSearch clusters on Kubernetes, and highlight opportunities for collaboration within the project.